Your connection to a website does not take a straight line. It hops through a series of routers, each one forwarding your packets a step closer to the destination. Traceroute makes those hops visible. MTR makes them continuously visible. Both tools are essential for diagnosing the kind of network problem that a simple ping cannot explain.
How traceroute exploits the TTL field
Every IP packet carries a TTL value, short for Time to Live. It is an integer that starts at 64 or 128 depending on the OS and decrements by one at each router hop. When it reaches zero, the router discards the packet and sends back an ICMP "time exceeded" message to the sender, including its own IP address.
Traceroute exploits this deliberately. It sends the first probe with TTL=1. The first router in the path decrements TTL to zero, discards the packet, and sends back the ICMP error, revealing its IP address. Then traceroute sends a probe with TTL=2, which reaches the second router. And so on, until a probe reaches the destination. The result is a map of every router between you and your target, along with round-trip times to each one.
On Linux and macOS, the command is traceroute. On Windows, it is tracert. The underlying mechanics differ slightly: UNIX systems default to UDP probes, while Windows uses ICMP echo requests, and you can also force TCP mode (useful when firewalls block ICMP).
Reading the output
Each line in traceroute output represents one hop. You see the hop number, the hostname or IP of the router (if it responds), and three round-trip times in milliseconds for the three probes sent to that hop. Asterisks appear when a router does not respond, either because it is configured to silently drop TTL-exceeded packets (common in ISP core networks), or because a firewall is blocking ICMP.
A row of asterisks does not necessarily mean something is wrong. Many core routers in large provider networks are deliberately configured not to reply to ICMP time exceeded messages. What matters is whether the next hop responds. If you see asterisks at every hop from a certain point, the connection is probably being blocked or routed into a black hole.
Latency interpretation requires some context. Hops within the same city or data center typically show under 5 milliseconds. Cross-continental hops over fiber should be 30 to 80 milliseconds depending on the physical distance. The speed of light in fiber is roughly 200,000 km per second, so New York to London is about 70ms in ideal conditions. If you see 200ms or more on a nearby hop, that packet is taking an unusual route or the router is rate-limiting ICMP responses.
MTR: the continuous version
MTR, originally called Matt's Traceroute and written by Matt Kimball in the mid-1990s, combines ping and traceroute into a live, continuously updating display. Instead of running once and finishing, MTR keeps sending probes and accumulates statistics: packet loss percentage, average latency, standard deviation, and best/worst times for every hop.
This continuous mode is what makes MTR genuinely useful for diagnosing intermittent problems. A 2% packet loss at hop 7 that disappears in a static traceroute might show up clearly in MTR after watching it for 60 seconds. Run it with:
mtr --report --report-cycles 100 example.com
The --report flag produces a single summary after 100 cycles instead of live updates, which is ideal for pasting into a support ticket or a monitoring system.
What to look for in the output
Increasing latency as packets travel further is expected and normal. What is not normal is a sudden spike at a specific hop that persists in all subsequent hops, which points to congestion or a problem at that particular router.
Packet loss at an intermediate hop but not at the destination is usually benign. It means that router deprioritizes ICMP responses but forwards real traffic fine. Packet loss that shows up at a hop and stays elevated at every subsequent hop is a different story and points to a genuine problem.
If you see the path taking an unexpected geographical detour visible through the IP geolocation of intermediate hops, that might indicate a BGP routing anomaly. In 2010, a Chinese ISP accidentally announced BGP routes for a large chunk of the internet, briefly routing US government traffic through China. Traceroute data was how researchers first noticed.
Practical use cases
When a website is slow only for you, running MTR lets you pinpoint whether the bottleneck is in your ISP, in the transit network between your ISP and the destination, or at the destination itself. A customer support ticket that includes a 100-cycle MTR report is far more useful than "the site is slow."
MTR is also useful for validating VPN routing. If you expect your traffic to exit through Amsterdam but MTR shows it routing through Frankfurt, the VPN is not working as advertised.
For diagnosing DNS resolution problems separately from routing, use our DNS Lookup tool first to confirm the domain resolves correctly, then run MTR against the returned IP to check the path.
WinMTR for Windows users
WinMTR is a graphical Windows port of MTR. It provides the same continuous statistics in a GUI, with export to text or HTML. You can download it from winmtr.net. For command-line purists on Windows, nmap also includes a traceroute mode with the --traceroute flag.
Frequently asked questions
Why does traceroute show different paths on different runs?
BGP routing is dynamic. Large ISPs use multiple paths and may load-balance at the flow level, meaning probes in the same traceroute might take different paths. Running traceroute multiple times can reveal this, as can using tools like Paris Traceroute, which uses consistent flow hashing.
What does it mean when a hop shows very high latency but later hops are normal?
The router at that hop is rate-limiting or deprioritizing ICMP responses while forwarding other traffic normally. This is extremely common in carrier-grade routers and is not a sign of a problem. The latency at the destination is what matters.
Can traceroute work over IPv6?
Yes. On Linux, use traceroute6 or traceroute -6. On Windows, use tracert -6 hostname. MTR handles IPv6 natively. The mechanics are the same, using the IPv6 hop limit field instead of IPv4 TTL.
What is the difference between traceroute and ping?
Ping tests whether a single destination is reachable and measures round-trip time to it. Traceroute maps the entire path between you and the destination, showing every router in between. Use ping for a quick reachability check, traceroute when you need to know where in the path a problem is occurring.
Run a quick check from your current location: Site Check tests reachability from multiple regions.